Is OAuth irrelevant when HTTPS is used?
I am designing a RESTful API which will always communicate over HTTPS. Is there any reason to use a scheme like OAuth when running over HTTPS? I am particularly intere开发者_如何学Gosted whether or not aspects like HMAC-signed requests, nonces, and timestamps are useful when the entire communication is encrypted.
It seems like any authentication scheme over HTTPS is sufficient but I just wanted to get a second opinion.
Well, that's the whole theory behind OAuth 2. Instead of the complicated signature mechanisms of OAuth 1, you just rely on transport-layer security and focus on the authorization piece of the puzzle. The HTTPS protocol does not solve the authorization piece, so you still need OAuth 2 for that.
精彩评论